3 Replies Latest reply on Dec 20, 2010 1:46 PM by ColinS Branched to a new discussion.

    Intruder Alert: Now what do I do ?

      I have McAfee SecurityCenter.   In the last couple of weeks, I  repeatedly get an "Intruder Alert".  It's always the same IP address.  I  checked "Block", but he keeps coming back. 

      The McAfee "My Network" box says the intruder cannot access my PC, but he continues to show as logged on to my network.

      Name: 192.168.1.253
      IP Address: 192.168.1.253
      MAC Address: 022417a7f26a

      I cannot find anything in McAfee's help system to tell me what to do about him.

      I have tried checking the IP address at whatismyipaddress.com, but it  only says "This is a private IP address and cannot be traced."

       

       

      Firewall is On.  In "Attack Detection", There is no mention of this intruder.  He only shows up in the "My Network" box.

      On McAfee help, "Working with Alerts", there is no information on what to do next.

      Surely there should be some way of reporting and dealing with people who are attempting to hack into our computers ?

       

      So what can I do to prevent this intruder logging on to my network ?

       

      Any help would be greatly appreciated.

      Thanks, Frank.

        • 1. Re: Intruder Alert: Now what do I do ?

          Bannerman,

           

          There may be a couple things at play here.  It really depends if you are running a wireless or wired network.  Not knowing your setup here are some possibilities:

           

          1. If you are running a wireless network and you keep seeing someone log on then it could be
            • that either you haven't turned on the security feature of your router
            • you turned on the security but never changed the default admin password on your router
            • you have security, changed the router password but are using WEP protection which is very easy to defeat by someone who knows how
          2. If you are running on a wired cable network and you have no router between your PC and the cable company's modem then you are probably seeing your neighbors who also subscribe to the cable Internet provider.  This is not unusual in the cable Internet setup.

           

          In case 1 - Adding security to your router - preferably WPA (WiFi Protected Access) or WPA2 - should eliminate unknown IP addresses from getting on your network.

          In case 2 - You can try adding a router between your PC and the cable modem.  That should take them off the network map.  You can also flag those IP addresses as intruders - this will block that IP address from having access to your PC.  Keep in mind that if you have other PCs in the house with McAfee protection that you would need to flag that IP address as an intruder on each PC.  We are considering adding a global setting in a future release so that all PCs on the network that have McAfee installed would share the intruder list.  There is no way to kick an unknown IP address off of your network.

           

          Hope that helps.

           

          Colin

          • 2. Re: Intruder Alert: Now what do I do ?

            Hi Colin,

            Thanks for your message.  I have a British Telecom 2.0 wireless router, with all the normal security features enabled.  Since I put that message up, the wireless modem in my laptop has failed, so I am using a plug-in USB wireless dongle.   Curiously, these particular McAfee alerts now no longer appear !   But the "intruder" still shows up on McAfee's "My Network" screen.

             

            My modem software shows up several of my neighbour's wireless systems, bu the is no way to discover if one of them is the "intruder", whether deliberately or inadvertantly, as I suppose the alert could be caused by someone else's modem trying to log on to a router when it is turned on.

             

            I have reasonable general knowledge of computer systems, but McAfee's "Intruder Alert"  message without further information just leaves me concerned and wondering what to do.

             

            McAfee needs to think about what effect their system alert messages have on their users, and provide clear information on what to do as a normal part of the system.  To show an "Intruder Alert" message, and then not say exactly what to do about it is just plain useless !  There should be no need to ask questions on a message board in the hope of finding out !

             

            Many thanks for your assistance,

            Frank.

             

             

            Message was edited by: bannerman on 17/12/10 20:25:41 GMT
            • 3. Re: Intruder Alert: Now what do I do ?

              Hi Frank,

               

              When you click on the alert you should be taken to the network map in McAfee where you can decide what you want to do about the new IP address that is showing up on your network map.

              You can edit the details if you are aware of the new node on the map, or you can mark it as an intruder which will prevent that node from accessing your PC.  Unfortunately we can't kick a node off of the network, we can only stop it from accessing your computer.  I will take a look at the alert that we display to see if it could be clearer as to the possible course of action.

               

              Colin